1. Omar Hemmali CAP 6135 Paul Barford Vinod Yegneswaran Computer Sciences Department University of Wisconsen, Madison

2.  Introduction  Architecture & Seven key mechanisms ◦ Architecture ◦ Control mechanisms ◦ Methods for proagation and attack  Contributions  Shortfalls

3.  The evolution of malware is primarily driven by improvements in defense mechanisms.  Worms and DoS attacks get a lot of media coverage while a major problem is overlooked.  Botnets are a more serious threat on the Internet today.  Botnets trace their roots to a benign management system.

4.  Botnets have increased in capability over the years.  Botnets have become quite extensive.  Focus has changed from vandalism to for- profit malicious activity.

5.  Comparison of 4 different Bot families. ◦ Agobot ◦ SDBot ◦ SpyBot ◦ GT Bot

6.  Architecture  Botnet Control Mechanisms  Host Control Mechanisms  Propagation Mechanisms  Exploits and Attack Mechanisms  Malware Delivery Mechanisms  Obfuscation Mechanisms  Deception Mechanisms

7.  20K LoC C/C++  Many high level components  IRC based C2 mechanism  Can launch different DoS attacks  Can harvest passwords  Fortify the system from attack  Actively attempts to prevent removal

8.  3K LoC C  Does not try to hide its malicious intent  Contains exploits for P2P and comm programs  Has ip scanning capabilities  Modules for DoS attacks

9.  SDBot  Uses a lightweight version of IRC,  Bots can rejoin channels if they get kicked.  They keep track of their master.  Commands are sent in the form of PRIVMSG.

10.  GT Bot  Uses IRC as the control infrastucture  Very few commands that are consistent among members of the family  Can invoke ip scanning

11.  Purpose is to fortify the compromised host against removal of the bot net  Agobot  Can return CD keys, registry info, emails  Able to kill specific processes that may try to cleans the infected host.

12.  SDBot  Controls are somewhat limited  Can remotely download files  Can create and terminate processes  Can send cd keys for popular games to BotMaster

13.  SpyBot and GT Bot  Have simple horizontal and vertical scanners  Just run through IPs in order.

14.  Agobot  Very elaborate  Scans for back doors left by other worms  Scans for passwords from open SQL servers  Can enable 7 DDoS Attack commands

15.  GTBot  Makes use of DCOM exploits  Has DDoS capabilities in the form of UDP and TCP floods.

16.  GTBots  Deliver the exploit in a single script  AgoBot  It first exploits an existing vulnerability  Then opens a shell on the remote host

17.  Agobot is the only one that has any obfuscation mechanisms.  It uses four different polymorphic schemes

18.  Again Agobot is the only one that has any elaborate mechanism  Tests for debuggers  Tests for VMWare  Kills Anti Virus processes  Alters DNS entries for anti-virus updates to point to localhost

19.  Compiled a lot of information about different flavors of Botnets.  Demonstrated that compromised machines not only acted as zombies for the master, opened users to ID theft.

20.  While the paper covers many different effects of Botnets, it doesn’t give ways to alleviate them.